Authentication Bypass in NATS-Server Affects NATS.io Messaging System

CVE-2026-33248

What is CVE-2026-33248?

NATS-Server, a robust messaging system for cloud and edge applications, is susceptible to an authentication bypass issue prior to versions 2.11.15 and 2.12.6. This vulnerability arises when mTLS is used for client identity verification, particularly when using the verify_and_map function to derive NATS identities from the Subject DN of client certificates. Certain rare patterns of RDN may not be strictly enforced, leading to potential authentication bypass. While exploitation requires a valid client certificate from a trusted CA and involves highly improbable DN naming patterns, administrators with particular attention to these configurations should assess their security practices. Upgrading to versions 2.11.15 or 2.12.6 is strongly recommended to mitigate this issue. Alternatively, a review of CA issuance policies may help address potential vulnerabilities.

References